CVE-2024-22415: Unsecured endpoints in the jupyter-lsp server extension

Impact

Installations of jupyter-lsp running in environments without configured file system access control (on the operating system level), and with jupyter-server instances exposed to non-trusted network is vulnerable to unauthorised access and modification of file system beyond the jupyter root directory. Please note this vulnerability is in the extension and is patched in version 2.2.2 of that extension. This extension has been updated in jupyterlab-lsp version 5.0.2.

Patches

Version 2.2.2 has been patched.

Workarounds

Users of jupyterlab who do not use jupyterlab-lsp can uninstall jupyter-lsp.

Credits

We would like to credit Bary Levy, researcher of pillar.security research team, for the discovery and responsible disclosure of this vulnerability.